MISCELLANEOUS PROVISIONS
Sec. 162. TRANSFER OF OWNERSHIP, DISCONTINUANCE OF SERVICES
This section contains detailed provisions for facilities that discontinue services or transfer control of such services to someone who will use individually identifiable DNA samples or private genetic information for a substantially different purpose than that authorized by the sample source or sample source's representative. Therefore, a sale of a business or practice in which DNA samples have been collected or stored to an individual or facility that will engage in different activities would require compliance with these provisions. However, sales of clinical practices in which DNA samples are collected or records containing private genetic information are maintained to practitioners who will provide similar services would not be affected by these rules. Neither would mergers between entities such as hospitals or laboratories that result in management or personnel changes but not in changes in the business or services provided. However, if individually identifiable DNA samples were, for instance, collected and stored in a research program on a genetic disease, a commercial enterprise such as a pharmaceutical company could not acquire the DNA samples or data bank that contains private genetic information, without meeting these provisions.
In regard to discontinuation of services or activities in which records containing private genetic information have been maintained, the holder of such records who does not receive a response from the subject of the information has the option of sealing and storing records for up to 3 years. [section 162(b)(2)(A)(ii)] This provision is intended to satisfy the concerns of those who fear that mandatory destruction of such records would hinder the defense of subsequent claims such as malpractice brought against the keeper of such records.
These rules will accommodate the commercial interests of individuals or entities that collect, store or analyze DNA samples or private genetic information, and who want to profit from the sale or transfer of their endeavors, without compromising the rights and interests created under this Act of persons who are affected by such changes.
Sec. 171. CIVIL REMEDIES
(a) PRIVATE RIGHT OF ACTION. -- Any person whose rights under this Act have been violated may maintain a civil action for damages or equitable relief as provided for in this section...
(c) RELIEF. -- In any action brought under this section, a court may order a person to comply with the provisions of this Act and may order any other appropriate equitable relief.
Under this section an aggrieved individual may maintain a cause of action for negligent or willful acts in violation of these rules. Where a person has acted negligently in the collection or analysis of a DNA sample, or in regard to disclosures of private genetic information, they will be liable for a minimum amount of $25,000. Although the individual who is harmed does not have to suffer actual damages in order to recover, if they do sustain actual damages which exceed $25,000, they can recover the greater amount. [section 171(d)(1)] The amount of actual monetary damages as a result of violations of these provisions may not be sufficient to motivate individuals to assert their rights. These liquidated damages have been made available so that injuries to personal privacy and dignity that result from violations can be prosecuted. The availability of treble damages in cases where the negligent person has profited from such unlawful actions is included to deter profiting from the invasion of another's privacy and as an incentive for individuals and entities governed by these rules to monitor their compliance and performance. Whether the person facing liability is an individual practitioner, an independent laboratory or a multi-service corporation, a $75,000 minimum potential liability for each violation that results in their benefit should be incentive to invest in effective risk management measures.
Under section 171(e), individuals can also recover for willful violations of these rules by individuals who induce another to collect or analyze a DNA sample in violation of these provisions, or who induce another to wrongfully disclose private genetic information. Consequently, anyone who exerts influence over those who actually collect or analyze DNA samples to obtain or analyze a sample without authorization, is exposed to liability for actual damages, or a liquidated damage amount of $50,000, whichever is greater. [sections 171(e)(1) and (2)]. Anyone who willfully collects or analyzes a DNA sample without proper authorization, or who willfully discloses private genetic information without authorization, is similarly liable.
Both the person who induces such action, and the person who engages in the unauthorized act, are liable for such punitive damages as the court may allow. [section 171(e)(2)(B)] As in negligence cases, if the individual who is harmed prevails, costs of the action and reasonable attorneys' fees shall also be awarded. Besides awarding monetary damages, courts are empowered to fashion equitable relief and remedies as necessary in particular circumstances. [section 171(c)] For example, a court can order destruction or return of DNA samples, purging of records, reinstatement of benefits or privileges denied through violations, and order a person or entity to comply with the provisions of the statute.
Sec. 172. CIVIL PENALTIES AND INJUNCTIVE RELIEF
Whenever the attorney general has reason to believe that any person is using or is about to use any method, act or practice in violation of the provisions of this Act, and that proceedings would be in the public interest, the attorney general may bring an action against such person to restrain by temporary restraining order or preliminary or permanent injunction the use of such method, act or practice. The action may be brought in the district court of the jurisdiction in which the person resides or has a principal place of business. The court may issue temporary restraining orders or preliminary or permanent injunctions and make such other orders of judgments as may be necessary to prevent harm or to remedy harm suffered by any person as a result of the use or employment of such method, act or practice in violation in the Act. If the court finds that a person has employed any method, act or practice which he knew or should have known to be in violation of this Act, the court may require such person to pay a civil penalty of not more than $50,000 for each such violation and may also require the said person to pay reasonable costs of investigation and litigation of such violation, including reasonable attorneys fees.
One problem which faces individuals whose privacy rights have been violated is that pursuit of remedial actions may contribute to further publication of genetic information and erosion of privacy. It may be possible to sue for wrongful collection or analysis of DNA and present necessary evidence without revealing private genetic information. Nonetheless, it is more likely that this information will be revealed since an essential proof in the case is that the information falls within the statutory definition of private genetic information. It will be up to individuals to assess the relative risks and benefits of asserting their rights and pursuing legal action. If the risks of pursuing such remedies inhibit individual enforcement, thereby diminishing the effectiveness of the Act, inclusion of additional methods of enforcement must be considered. The two remaining possibilities are: criminal actions and/or civil penalties.
Criminal penalties through fines and imprisonment for violations of this Act are not included or recommended. Despite a desire to draft a law that gives protection to the privacy interests of individuals and that would adequately deter unauthorized collection of DNA samples and unauthorized disclosures of private genetic information, we decided that creation of a new federal crime would not necessarily serve such goals. Criminal sanctions are appropriate when other methods of inducing compliance are ineffective or when the interests served by the law are best promoted through pursuit of criminal actions.
There is no reason to assume that there will not be voluntary compliance with the Act. Granting broad powers of law enforcement investigation and prosecution in areas that contain highly sensitive and personal information, and the risks to privacy that such power presents, must be balanced against this assumed low rate of noncompliance. Unless or until it is demonstrated that violations of the privacy rights created under the Act are sufficient in number or in degree of harm so as to warrant creation of a new federal crime, we do not recommend the inclusion of criminal sanctions. Additionally, it is our belief that such prosecutions could not realistically be given priority over the myriad federal crimes that now exist; nor would there be a likelihood that the severity of sentences that are likely to be imposed or arrived at through plea arrangements would have a deterrent effect greater than is presented by the threat of civil liability.
In addition to providing private civil actions and criminal sanctions, other statutes containing fair information practices either look to an administrative agency for enforcement, or authorize the attorney general to pursue civil penalties for violations of fair practices. For instance, the Fair Credit Reporting Act (FCRA) [15 USC 1681 (a)] authorizes the Federal Trade Commission to use powers granted by the Federal Trade Commission Act to enforce the provisions of the FCRA, and to bring actions to redress consumer complaints.
In regard to oversight of compliance with the Act, it might be useful to give enforcement powers to an independent board or agency. Although no privacy protection board currently exists, the concept of a data protection board has been introduced and recommended to Congress repeatedly over the last 20 years. Since the introduction of the Privacy Act of 1974, the need for an independent board which would, among other things, monitor and evaluate laws designed to protect personal privacy has been identified. In recent years, the proliferation of computer generated personal information systems has led to a renewed interest in a board charged with developing model standards, proposing legislation, and investigating complaints about violation of privacy or data protection rights.[56]
Even if such proposals were heeded, and a board created, its effectiveness in protecting individual privacy interests would be negligible unless it was granted enforcement powers in addition to investigative and advisory functions.[57] If a board with such inclusive powers is established in the future, we recommend that it be given jurisdiction over the investigation and enforcement of violations of this Act. To effectuate such a mandate, the Genetic Privacy Act could be amended to include a provision for the reporting of violations to the Board which could impose civil penalties on persons found to be in violation. Given that establishment of such a board is unlikely in the near future, this leaves one additional alternative for enforcement of civil penalties on violators of the Act. That is to authorize the Attorney General to bring civil actions against violators and to enforce the rights created by the Act.
EFFECTIVE DATES; APPLICABILITY; AND RELATIONSHIP TO OTHER LAWSPART I
Sec. 183. RELATIONSHIP TO OTHER LAWS
(c) Nothing in this Act shall be construed as limiting or prohibiting the pursuit of any other remedies available under common or statutory law in regard to the collection, storage, analysis of DNA samples, and the disclosure of private genetic information.
This Act does not supersede or preempt any federal or state law that provides additional privacy protection to sample sources. Consequently, states that pass legislation restricting the use of genetic analysis for particular purposes may do so. For example, nothing in the Act would limit a state's authority to prohibit genetic testing by employers or insurance companies. States, however, may not take actions that conflict with the protection provided by this Act. State statutes, for example, that would mandate genetic screening or testing of identifiable newborns would be preempted by these provisions if they analyzed DNA analysis and did not require the prior authorization of the parent.
The actions available under the Act to address wrongful violations are limited to civil actions and civil penalties; nonetheless, the Act does not prevent states from providing additional remedies, such as making unauthorized collection or analysis of DNA samples a crime, or criminalizing unauthorized disclosures of private genetic information.
The provision of the right to bring a civil action for damages does not prevent pursuit of other tort claims where the facts would support such causes of action and when available under state common or statutory law. For example, an action for publication of private facts would not be precluded by the remedy available here. Information covered by this Act may also be covered by other confidentiality statutes. Such concurrent coverage is intended so as to maximize the protection of private information. State laws which prohibit obtaining genetic information in particular circumstances, or the use of such information for particular purposes, would not be superseded by the Act. Therefore, states which prohibit employers or insurers from requiring individuals to submit to genetic analysis[58] could continue to enforce such prohibitions. States could also mandate requirements in regard to the consent process for genetic analysis in all or particular circumstances which go beyond those required by the Act.[59]